How can the BIOS block virtualization?

Solution 1:

It's not that the CPU is blocking a program; it doesn't have a concept of apps at that low of a level. The problem is that Docker on non-Linux operating systems can require hardware virtualization. You haven't specified your OS, but I did a tiny bit of snooping and discovered that you probably use Windows.

Hardware virtualization is a CPU feature that, as you might guess from the name, lets the CPU help with virtualization. On many machines, you have to enable it in the BIOS. This is, in part, to prevent security issues. Basically, you couldn't start a program because it attempted to use a feature that was effectively absent as opposed to actively blocked.

Solution 2:

Ben N answer is clearly the most useful and clear one.

For those who still wonder, however here is the full story.

Virtualization is achieved with hardware assist from the CPU. Since a virtualized OS would interfere with the host one, as they compete for the same resources, a mechanism is needed to stop the guest from having uncontrolled access to the hardware. This can be down with software, slow, techniques or with assist from the CPU.

Hardware assisted virtualization is implemented with specific, optional instructions, you can read about it in Chapters 23, 24, 25, 26, 27 and 28 of Intel Manual 3B Part 3. Software must first check for this instructions to be supported, before attempting using them.

For security reason, the CPU has a special register, it is an MSR, called IA32_FEATURE_CONTROL that holds bits telling with feature to enable or disable.
Quoting

Bit 0 is the lock bit. If this bit is clear, VMXON causes a general-protection exception. If the lock bit is set, WRMSR to this MSR causes a general-protection exception; the MSR cannot be modified until a power-up reset condition. System BIOS can use this bit to provide a setup option for BIOS to disable support for VMX. To enable VMX support in a platform, BIOS must set bit 1, bit 2, or both (see below), as well as the lock bit.

The fundamental point is that once the register is locked, it cannot be unlocked until a power-up.

Since BIOS/UEFI comes first, it has the power to disable virtualization by clearing the appropriate bits and locking the register before any OS can prevent that. When the virtualization feature is disabled this way, the CPU reports that it the optional instruction extension is missing (and actually faults if they are used) and so the software cannot use the hardware virtualization.